Description
AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions service that builds CrowdStrike Real Time Response command strings by interpolating unescaped action parameters in crowdstrike_rtr.py and endpoint.py. Authenticated users can inject single quotes into file_path, path, script_name, or script_args parameters to break out of quoted arguments and execute arbitrary commands on managed endpoints with SYSTEM or root privileges.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| beenuar | AiSOC | 7.2.0 – < 12.0.0 | 12.0.0 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
hyderpwn/CVE-aisoc ★ 0 · Oct 30, 2026
CVE-2026-103056 (CVSS 4.0 9.4 Critical) — AiSOC < 12.0.0 OS command injection into CrowdStrike RTR command strings. Verified standalone PoC.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- GitHub Security Advisory (GHSA-7q37-2wfw-xrx7) vendor-advisory
- https://github.com/beenuar/AiSOC/commit/dac39723404130312daba15d42d19114f09f75b2 patch
- AiSOC v12.0.0 Release Notes release-notes
- https://github.com/beenuar/AiSOC/blob/v11.2.0/services/actions/app/clients/crowdstrike_rtr.py#L273 technical-description
- https://github.com/beenuar/AiSOC/blob/v11.2.0/services/actions/app/executors/endpoint.py#L442 technical-description
- VulnCheck Advisory: AiSOC 7.2.0 before 12.0.0 Command Injection via CrowdStrike RTR third-party-advisory